nornir-vault — for idiots
Class:
idiot· Zero-knowledge walkthrough. Stub — expand as korp wiring lands.
What is this?
A little locked box on the thin client's disk that holds its secrets (a login certificate, a Spark token). Without the key, the box is scrambled bytes. This stops someone who is looking at the container's screen/disk from just reading the secrets straight off the filesystem.
The one idea: two keys, like a safe-deposit box
- There is a content key (the DEK) that scrambles the secrets. It is random and you never see it.
- That content key is itself locked inside the box by a door key (the KEK).
- Your PIN makes the door key (via a slow, deliberately-expensive step called Argon2id, so guessing is painful). Or, on the desktop, the door key can live in the OS keyring so the box opens without a PIN prompt.
Open the box (unlock) and the secrets appear in memory only — never written back to the disk unscrambled. Close it (lock) and they are wiped.
What you do
- Create the box with a PIN. It starts open.
- Put the cert / token in.
- Lock it (or just quit — it is already saved scrambled).
- Next time: open the file, type the PIN, read the secret.
Careful
- Type the wrong PIN too many times (default 5) and the box locks itself — on purpose. Then even the right PIN will not open it; you start a fresh box.
- Never print or log a secret. The types are built to refuse, so do not fight them.
More
See vault-guide.md for the code and vault-design.md for how it works inside.